1. Shibboleth Update a.k.a. “shibble-ware”
Michael R Gettes, Duke University
On behalf of the project team
November 2004

2. What is Shibboleth? (Biblical)
A word which was made the criterion by which to distinguish the Ephraimites from the Gileadites. The Ephraimites, not being able to pronounce “sh”, called the word sibboleth. See --Judges xii.
Hence, the criterion, test, or watchword of a party; a party cry or pet phrase.
Webster's Revised Unabridged Dictionary (1913)

3. What is Shibboleth? (modern era)
An initiative to develop an architecture and policy framework supporting the sharing – between domains -- of secured web resources and services
A project delivering an open source implementation of the architecture and framework
Deliverables:
Software for Identity Provider (Origins/campuses)
Software for Service Providers (targets/vendors)
Operational Federations (scalable trust)

4. So… What is Shibboleth? A Web Single-Signon System (SSO)?
An Access Control Mechanism for Attributes?
A Standard Interface and Vocabulary for Attributes?
A Standard for Adding Authn and Authz to Applications?

5. Attribute-based Authorization
Identity-based approach
The identity of a prospective user is passed to the controlled resource and is used to determine (perhaps with requests for additional attributes about the user) whether to permit access.
This approach requires the user to trust the target to protect privacy.
Attribute-based approach
Attributes are exchanged about a prospective user until the controlled resource has sufficient information to make a decision.
This approach does not degrade privacy.

6. How Does it Work?
Hmmmm…. It’s magic. :-)

7. Shibboleth AA Process Service Provider Identity Provider Web Site 4
OK, I redirect your
request now to
the Handle Service
of your home org. 3 2
Please tell me
where are you from?
Shibboleth AA Process 1
ACS
I don’t know you.
Not even which home
org you are from.
I redirect your request
to the WAYF
WAYF HS 5 6
I don’t know you.
Please authenticate
Using WEBLOGIN
Identity Provider
Service Provider
Web Site 7
User DB
Credentials
OK, I know you now.
I redirect your request
to the target, together
with a handle
Attributes 10
Manager
Resource
OK, based on the
attributes, I grant
access to the
resource AR
Handle 8
I don’t know the
attributes of this user.
Let’s ask the Attribute
Authority
Handle 9 AA
Let’s pass over the
attributes the user
has allowed me to
release
Resource

8. From Shibboleth Arch doc
Identity Provider
Service Provider

9. From Shibboleth Arch doc
Identity Provider
Service Provider

10. WAYF a second! WAYF WAYF is just a simple navigation tool
Provides NO, ZERO, NADA, ZIP security
It does NOT represent the federation
Federation != WAYF
WAYF != Federation
Consideration for WAYF security is a future item
WAYF is just a simple navigation tool

11. Demo!

12. Shibboleth Architecture
Resource
WAYF
Identity Provider
Service Provider
Web Site 1
ACS 3 2 HS 5 6 7
User DB
Credentials 4 AR
Handle 8 9 AA
Attributes 10
Manager
© SWITCH

13. Shibboleth Architecture -- Managing Trust
engine
Attribute
Server
Service Provider Web Server
Browser

14. Typical Attributes in the Higher Ed Community
Affiliation
“active member of community”
EPPN
Identity
Entitlement
An agreed upon opaque URI
urn:mace:vendor:contract1234
OrgUnit
Department
Economics Department
EnrolledCourse
Opaque course identifier
urn:mace:osu.edu:Physics201

15. Target – Managing Attribute Acceptance
Rules that define who can assert what…..
MIT can assert
Chicago can assert
Brown CANNOT assert
Important for entitlement values

16. What are federations? Initially “Authenticate locally, act globally”
Associations of enterprises that come together to exchange information about their users and resources in order to enable collaborations and transactions
Built on the premise of
Initially “Authenticate locally, act globally”
Now, “Enroll and authenticate and attribute locally, act federally.”
Federation provides only modest operational support and consistency in how members communicate with each other
Enterprises (and users) retain control over what attributes are released to a resource; the resources retain control (though they may delegate) over the authorization decision.
Over time, this will all change…

17. InCommon federation First US Higher Ed Federation
Precursor federation, InQueue, a proving ground or testbed and will feed into InCommon after organizations are deemed interoperable.

18. Service Providers http://shibboleth.internet2.edu/
And see the link on the left labeled
“Shib-enabled Service Providers”

19. So… What is Shibboleth? A Web Single-Signon System (SSO)?
An Access Control Mechanism for Attributes?
A Standard Interface and Vocabulary for Attributes?
A Standard for Adding Authn and Authz to Applications?

20. Sample InterFederation

21. Got SHIB?

22. Inter-Enterprise Authentication
Is Shibboleth authentication?
If so, to what degree?
How does Shibboleth compare to PKI?
PKI basics, no crypto -- just process
Greater understanding of what Shibboleth really brings to the landscape
Knowing what we are doing and why

23. PKI Authentication Basics
Server
User Certificate
Private Key

24. Validation
Server (application) performs validation steps of credential presented
Verifies CA signing cert is valid
Certificate Path Validation processing
Verifies the cert presented is valid
Certificate Revocation Tests
OCSP, CRLs
Applying the Private Key authenticates the end entity directly

25. Inter-Realm (server chooses trust)CA CA
Server
User Certificate
Private Key

26. Shibboleth Architecture
Resource
WAYF
Identity Provider
Service Provider
Web Site 1
ACS 3 2 HS 5 6 7
User DB
Credentials 4 AR
Handle 8 9 AA
Attributes 10
Manager
© SWITCH
Authentication
Attribute Release

27. What shib does… SAML assertion from HS to ACS
The Identity Provider is testifying about the Handle being passed
The ACS performs validation of Id Provider
Like PKI Path Validation (albeit simple)
The Service Provider trusts that the End Entity has been authenticated per the rules of the trust fabric

28. What shib does… (2) Are Attributes the result of authentication?
Where does Level of Assurance fit in?
Is LoA an attribute or part of authN?
Are shib LoA and PKI LoA different?

29. Q & A -- How can we help you?